VulnerabilityModified

CVE-2020-1953

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements.

CRITICAL 10.0EPSS 6.85%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (6.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

CVSS 3.1: 10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS: 6.85% probability · 94th percentile
CISA KEV: Not listed
Affected: apache/commons configuration · oracle/database server · oracle/healthcare foundation
Source: security@apache.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.